The OWASP LLM Top 10 is a community list of the risks that show up most often in LLM applications.
OWASP publishes the equivalent list for web applications, and this one borrows the same format.
Prompt injection, insecure output handling and excessive agency sit near the top of it.
Its real value is shared vocabulary, so a finding in a review has a name everyone recognises.
Use it as a prompt for threat modelling, not as a complete description of your own risks.
The OWASP LLM Top 10 is a community-maintained list of the risks that appear most often in LLM applications.
OWASP has published the equivalent list for web applications for years, and this one borrows the format deliberately.
Its value is shared vocabulary more than novelty.
When a review finding has a name, everyone in the room already knows roughly what it means.
Prompt injection has held the top slot since the first edition, and nothing has displaced it.
Insecure output handling covers trusting a model response in whatever system consumes it next.
Excessive agency covers handing a model more tools and permissions than its task actually needs.
Training data poisoning, sensitive information disclosure and supply chain weaknesses all have their own entries.
Unbounded consumption is the entry that denial of wallet falls under.
The list is revised between editions as the field learns what genuinely gets exploited rather than what sounds alarming.
Work through each item against your own architecture and ask what would happen if it went wrong.
That exercise is worth more than the list itself, because it forces you to name your own trust boundaries.
Most entries reduce to two habits: never trust model output, and never grant more permission than the task requires.
It will not describe every risk you have, because some risks belong to your system alone.
Treat a clean pass against the list as a floor to build on, not a finish line to stop at.
One question on this card. Every option explains itself once you pick, right or wrong.
16 concepts in this module, then a graded test with every answer explained.